EP1082661A4 - Procede et appareil de gestion de systemes informatiques redondants pour traitement tolerant aux fautes - Google Patents
Procede et appareil de gestion de systemes informatiques redondants pour traitement tolerant aux fautesInfo
- Publication number
- EP1082661A4 EP1082661A4 EP99930130A EP99930130A EP1082661A4 EP 1082661 A4 EP1082661 A4 EP 1082661A4 EP 99930130 A EP99930130 A EP 99930130A EP 99930130 A EP99930130 A EP 99930130A EP 1082661 A4 EP1082661 A4 EP 1082661A4
- Authority
- EP
- European Patent Office
- Prior art keywords
- data
- node
- rms
- fault
- computing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
- G06F11/187—Voting techniques
- G06F11/188—Voting techniques where exact match is not required
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
- G06F11/181—Eliminating the failing redundant component
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
- G06F11/182—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits based on mutual exchange of the output between redundant processing components
Definitions
- the present invention relates to computing environments, more particularly, it relates to a method for managing redundant computer-based systems for fault-tolerant computing.
- Fault tolerant computing assures correct computing results in the existence of faults and errors in a system.
- the use of redundancy is the primary method for fault tolerance.
- redundancy There are many different ways of managing redundancy in hardware, software, information and time. Due to various algorithms and implementation approaches, most current systems use proprietary design for redundancy management, and these designs are usually interwoven with application software and hardware. The interweaving of the application with the redundancy management creates a more complex system with significantly decreased flexibility.
- the redundant computing system is constructed by using multiple hardware computing nodes (or channels) and installing a redundancy management system (RMS) in each individual node in a distributed environment.
- RMS redundancy management system
- the RMS is a redundancy management methodology implemented through a set of algorithms, data structures, operation processes and design applied through processing units in each computing system.
- the RMS has wide application in many areas that require high systems dependability such as aerospace, critical control systems, telecommunications, computer networks, etc.
- the RMS and application integration is accomplished by a programmable bus interface protocol which connects the RMS to application processors.
- the RMS includes a Cross Channel Data Link (CCDL) module and a Fault Tolerant Executive (FTE) module.
- the CCDL module provides data communication for all channels while the FTE module performs system functions such as synchronization, voting, fault and error detection, isolation and recovery.
- System fault tolerance is achieved by detecting and masking erroneous data through voting, and system integrity is ensured by a dynamically reconfigurable architecture that is capable of excluding faulty nodes from the system and re-admitting healthy nodes back into the system.
- the RMS can be implemented in hardware, software, or a combination of both
- the distributed system can have two to eight channels (or nodes) depending upon system reliability and fault tolerance requirements.
- a channel consists of a RMS and an application processor(s). Channels are interconnected together through the RMS's CCDL module to form a redundant system.
- FIG. 1 is a block diagram of the redundancy management system according to an embodiment of the present invention.
- FIG. 2 is a block diagram of a three-channel RMS based fault tolerant system according to an exemplary embodiment of the present invention
- FIG. 3 is a state transition diagram of the redundancy management system according to an embodiment of the invention.
- FIG. 4 is a block diagram of the redundancy management system, the application interaction and voting process according to an embodiment of the invention.
- FIG. 5 is a schematic diagram of the context of the fault tolerant executive according to an embodiment of the present invention.
- FIG. 6 is a block diagram of the voting and penalty assignment process performed by the fault tolerator according to an embodiment of the invention.
- FIG. 7 is a schematic diagram of the context of the redundancy management system according to an embodiment of the invention.
- FIG. 8 is a diagram of the cross channel data link message structure according to an embodiment of the invention.
- FIG. 9 is a block diagram of the cross channel data link top level architecture according to an embodiment of the invention.
- FIG. 10 is a block diagram of the cross channel data link transmitter according to an embodiment of the invention.
- FIG. 11 is a block diagram of the cross channel data link receiver according to an embodiment of the invention.
- the redundancy management system provides the following redundancy management functions: 1) Cross-channel data communication; 2) Frame-based system synchronization; 3) Data Voting; 4) Fault and error detection, isolation and recovery; and 5) a graceful degradation and self healing.
- the cross-channel data communication function is provided by the CCDL module.
- the CCDL module has one transmitter and up to eight parallel receivers. It takes data from its local channel and broadcasts data to all channels including its own. Communication data is packaged into certain message formats and parity bits are used to detect transmission errors. All CCDL receivers use electrical-to-optical conversion in order to preserve electrical isolation among channels. Therefore, no single receiver failure can over drain current from other channel's receivers resulting in a common mode failure across the system.
- the RMS is a frame-based synchronization system. Each RMS has its own clock and system synchronization is achieved by exchanging its local time with all channels and adjusting the local clock according to the voted clock.
- a distributed agreement algorithm is used to establish a global clock from failure by any type of faults, including Byzantine faults.
- the RMS employs data voting as the primary mechanism for fault detection, isolation and recovery. If a channel generates data which is different from a voted majority, the voted data will be used as the output to mask the fault. The faulty channel will be identified and penalized by a global penalty system. Data voting includes both application data and system status data.
- the RMS supports heterogeneous computing systems in which fault-free channels are not guaranteed to produce the exact same data (including data images) due to diversified hardware and software. A user specified tolerance range defines erroneous behavior should a data deviation occur in the voting process.
- the RMS supports a graceful degradation by excluding a failed channel from a group of synchronized, fault- free channels defining the operating set.
- a penalty system is designed to penalize erroneous behavior committed by any faulty channel. When a faulty channel exceeds its penalty threshold, other fault-free channels reconfigure themselves into a new operating set that excludes the newly identified faulty channel.
- the excluded channel is not allowed to participate in data voting and its data is used only for monitoring purposes.
- the RMS also has the capability, through dynamic reconfiguration, to re-admit a healthy channel into the operating set. This self-healing feature allows the RMS to preserve system resources for an extended mission.
- FIG. 1 shows a top-level block diagram of the RMS system according to an embodiment of the present invention.
- the RMS 12 includes a cross channel data link (CCDL) module 24a, and a fault tolerator executive module 13.
- the FTE 13 is resident on a VME card or other single board computer, and is connected to other cards in a system via the VME backplane bus or other suitable data bus.
- the RMS 12 is connected to other RMS's resident on each card via the CCDL module 24a.
- Each RMS includes its own CCDL module for establishing a communication link between the respective RMS's. The establishment of a communication link via the CCDLs provides additional flexibility in monitoring the integrity of all cards in a system. By implementing a RMS on each computing node, and connecting the same to each other, system faults can be detected, isolated, and dealt with more efficiently than other fault tolerant systems.
- FIG. 2 An exemplary three-channel RMS-base system architecture 10 according to an embodiment of the present invention is depicted in FIG. 2.
- the RMS interconnects three Vehicle Mission Computers (VMC) to form a redundant, fault tolerant system.
- VMC Vehicle Mission Computers
- Each VMC has a VME chassis with several single-board computers in it.
- the RMS 12 is installed in the first slot of VMC 1, and the communication between RMS and other application boards is through the VME backplane bus 14.
- Each VMC takes inputs from its external 1553 buses.
- the three main applications, Vehicle Subsystem Manager 16, Flight Manager 18 and Mission Manager 20, compute their functions and then store critical data in VME global memory (see FIG. 7) for voting.
- Each RMS 12, 22 and 32, of the respective boards VMC1, VMC2 and VMC3, takes data via the VME bus and broadcasts the local data to other channels through the cross channel data link (CCDL) 24. After receiving three copies of data, the RMS will vote and write the voted data back to the VME global memory for use by the applications.
- CCDL cross channel data link
- Each channel in the RMS is defined as a fault containment region (FCR) for fault detection, isolation, and recovery.
- FCR fault containment region
- an FCR usually has a territory bounded by natural hardware/software components.
- the key property of the FCR is its capability to prevent fault and error propagation into another region. Multiple faults occurring in the same region are viewed as a single fault because other regions can detect and correct the fault through the voting process.
- the number of simultaneous faults a system can tolerate depends upon the number of fault- free channels available in the system. For non-Byzantine faults, N 2f+l where N is the number of fault-free channels and f is the number of faults. If a system is required to be Byzantine safe, N 3fr_. + 1 where f ⁇ is the number of Byzantine faults.
- the RMS can tolerate faults with different time durations such as transient faults, intermittent faults and permanent faults.
- a transient fault has a very short duration and occurs and disappears randomly.
- An intermittent fault occurs and disappears periodically with a certain frequency.
- a permanent fault remains in existence indefinitely if no corrective action is taken.
- rigorous pruning of faulty components can shorten fault latency, and thus, enhance the system's integrity. Nevertheless, immediate exclusion of transiently faulty components may decrease systems resources too quickly, and jeopardize mission success.
- the fault tolerance of the RMS allows a user to program its penalty system in order to balance these two conflicting demands according to application requirements. Different penalties can be assigned against different data and system errors. High penalty weights for certain faults will result in rapid exclusion of faulty channels when such faults occur. Low penalty weights against other faults will allow a faulty channel to stay in the system for a predetermined time so that it can correct its fault through voting.
- fault containment in three-node configuration excludes faulty channels when penalties exceed the user- defined exclusion threshold.
- a channel is re-admitted into the operating set when its good behavior credits reach the re-admission threshold.
- Conflicts in application or channel data are resolved by mid-value selection voting.
- the RMS cannot detect or exclude a faulty node. As such, voting cannot be used to resolve conflicts.
- the application must determine who is at fault and take appropriate action.
- the RMS has two subsystems, Fault Tolerant Executive (FTE) and Cross-Channel Data Link (CCDL).
- FTE consists of five modules (FIG. 5): 1) a Synchronizer 80; 2) a Voter 58; 3) a Fault Tolerator (FLT) 84; 4) a Task Communicator (TSC) 46; and 5) Kernal (KRL) 52.
- FTL Fault Tolerant Executive
- TSC Task Communicator
- KRL Kernal
- the Synchronizer (SYN) 80 (FIG. 5) establishes and maintains channel synchronization for the system. It is required that, at any time, each individual RMS must be in, or operate in one of five states: l)POWER_OFF; 2) START P; 3) COLD START; 4) WARM_START; and 5) STEAD Y_STATE.
- FIG. 2 shows a state transition diagram of an individual RMS and its five states.
- POWER OFF is the state when the RMS is non-operational and the power source of the associated computer is off for any reason.
- the RMS When the RMS is powered-up, the RMS unconditionally transitions to START-UP.
- START_UP is the state after the computer has just been powered up and when all system parameters are being initialized, RMS timing mechanisms are being initialized and the inter-channel communications links (i.e., CCDLs) are being established. When the start-up process is complete, the RMS unconditionally transitions to COLD_START.
- COLD START is the state in which the RMS cannot identify an existing Operating Set (OPS) and is trying to establish an OPS.
- OPS Operating Set
- the OPS is a group of nodes participating in normal system operation and voting.
- the RMS transitions from a WARM_START to COLD_START when less than two RMSs are in the OPS.
- WARM_START is the state in which the RMS identifies the OPS containing at least 2 RMSs but the local RMS itself is not in the OPS.
- STEAD Y_STATE is the state when the node of the RMS is synchronized with the OPS.
- a STEAD Y_STATE node can be in or out of the OPS.
- Each node in the OPS is performing its normal operation and voting.
- a node not included in the OPS is excluded from voting but its data is monitored by the OPS to determine its qualification for readmission.
- an Interactive Convergence Algorithm is used to synchronize channel clocks into a converged clock group which is the operating set (OPS). All members are required to have a consistent view about their memberships in the OPS and they all switch to the Steady-State mode at the same time.
- each channel broadcasts its local time to all channels through a System State (SS) message. Every channel dynamically adjusts its local clock to the global clock in order to maintain system synchronization. Since RMS is a frame- synchronized system, it has a predetermined time window called the Soft-Error Window (SEW) that defines the maximum allowable synchronization skew. Each fault-free RMS should receive other SS messages in the time interval bounded by the SEW. Since RMS is used in a distributed environment, using a single SEW window has an inherent ambiguity in determining synchronization errors among participating channels. See, P. Thambidurai, A.M. Finn, R.M. Kieckhafer, and C.J.
- SEW Soft-Error Window
- HEW Hard-Error Window
- channel "A" is correct, other channels should observe that channel "B's” clock has arrived at least outside of their SEW. Sustained by other channel's error reports, the system can then identify channel “B” as the faulty channel. Otherwise, channel "A” is the faulty channel because of its deviation from majority view in the error report.
- Warm-Start (WS) is halfway between Cold-Start and Steady-State.
- a channel may be excluded from the OPS because of faults and errors. The excluded channel can go through reset and try to re-synchronize with the operating set in the Warm-Start mode. Once the channel detects that it has synchronized with the global clock of the operating set, it can switch to the Steady-State mode. Once in the Steady-State mode, the excluded channel is monitored for later re-admission into the OPS. Time Synchronization within a VMC utilizes location monitor interrupts generated by RMS, and the VSM Scheduler uses frame boundary and Mid-frame signals for scheduling tasks.
- Time Synchronization across the VMCs ensures source congruence.
- the CCDL time stamps RMS system data messages received over the 8Mbit data link.
- the FTE gets the RMS system data from the VMCs and votes the time of these received messages, and adjusts CCDL local time to the voted value.
- the FTE then generates an interrupt on the synchronized frame boundary
- voting is the primary technique used for fault detection, isolation, and recovery.
- the voting of system states establishes a consistent view about system operation such as the membership in the OPS and synchronization mode.
- the voting on error reports formulate a consensus about which channel has erroneous behavior and what the penalty for these errors should be.
- the voting on application data provides correct data output for the application to use.
- the data voting sequence is shown in FIG. 4.
- the RMS data voting is a cyclic operation driven by a minor frame boundary.
- a minor frame is the period of the most frequently invoked task in the system.
- a four channel system generates application data 40 in a minor frame and stores the data in a raw data shared memory 42 known as the application data table for RMS to vote.
- the Task Communicator (TSC) module 46 of the RMS uses the Data-Id Sequence Table (DST) 48 as pointers to read the data from application data table 42.
- the DST 48 is a data voting schedule which determines which data needs to be voted in each minor frame, and it also contains other associated information necessary for voting.
- the TSC 46 After reading the data, the TSC 46 packages the data into a certain format and sends the data to the CCDL 24.
- the CCDL broadcasts its local data to other channels while receiving data from other channels as well.
- the Kernal (KRL) 52 takes the data from the CCDL 24 and stores the data in the Data Copies Table 56 where four copies of data are now ready for voting (i.e., 3 copies from other RMSs and one from the present RMS).
- the voter (VTR) 58 performs voting and deviance checks.
- a median value selection algorithm is used for integer and real number voting and a majority voting algorithm is used for binary and discrete data voting.
- the data type and its associated deviation tolerance are also provided by the DST 48 which is used by the VTR 58 to choose a proper voting algorithm.
- the voted data 60 is stored in the Voted Data Table 62.
- the TSC module 46 reads the data from the voted table 62 and writes it back to the Application Data Table (or voted data shared memory) 66 as the voted outputs. Again, the addresses of the output data are provided by the DST 48.
- a data conflict flag may be set in the Data Conflict Table 64 by the VTR 58 if the system has only two operating channels left and the VTR detects the existence of data disagreement.
- the Data Conflict Table 64 is located in a shared memory space so that the application software can access the table to determine if the voted data is valid or not.
- Table 1 is an exemplary table of data voting options where the specified data types are IEEE standard data types for ANSI "C" language.
- FCR fault tolerator
- OPS Operating Set which is defined as the set of fault- free system nodes in Steady-State mode
- the FLT 84 assesses a penalty 104 against a channel which is the source of errors.
- all detected (reported) errors 100 are assigned with penalties using a penalty weight table 102, and the penalty sum is stored in a Incremental Penalty Count (IPC).
- the local IPC is assessed (104), and broadcast (106) to the other nodes via the CCDL.
- the FLT module votes on the IPC (108) and the voted result is stored in a Base Penalty Count (BPC) 110.
- BPC Base Penalty Count
- the IPC captures errors for a particular minor frame and the BPC captures cumulative errors for entire mission time.
- the IPC vector is cleared (112), and the BPC is broadcast (114) to the other nodes via the CCDL.
- the BPC is also voted (116) every minor frame and the FLT uses the voted BPC to determine whether a penalty assignment and voting is required in order to ensure a consistent action among all fault-free channels for system reconfiguration.
- the FLT determined whether a major frame boundary has been reached (118). If yes, the reconfiguration is determined (120). If the major frame boundary is not reached, the process returns to the error report 100, and continues from the beginning.
- the system reconfiguration includes both faulty channel exclusion and healthy channel re-admission. If the Base Penalty Count (BPC) of a faulty channel exceeds a predetermined threshold, the RMS starts the system reconfiguration. During the reconfiguration, the system regroups the operating set to exclude the faulty channel. Once a channel loses its membership in the operating set, its data and system status will no longer be used in the voting process. The excluded channel needs to go through a reset process. If the reset process is successful, the channel can try to re-synchronize itself with the operating set and it can switch to the Steady-State mode if the synchronization is successful. An excluded channel can operate in the Steady-State mode, but is still outside of the operating set. The channel now receives all system messages and application data from the nodes in the operating set.
- BPC Base Penalty Count
- All members in the operating set also receive messages from the excluded channel and monitor its behavior.
- the BPC of the excluded channel may be increased or decreased depending upon the behavior of the channel. If the excluded channel maintains fault-free operation, its BPC will be gradually decreased to below a predetermined threshold, and at the next major frame boundary, the system goes through another reconfiguration to re-admit the channel.
- the current RMS implementation uses the VME bus and shared memory as the RMS and application interface. However, this is only one possible implementation and other communication protocol can also be employed to implement the interface.
- the main function of the TSC module 46 (FIG. 4) is to take data from designated communication media and package data into a certain format for the RMS to use. When a voting cycle is complete, the TSC takes the voted data and sends the data back to application.
- FIG. 5 shows a schematic diagram of the context of the fault tolerance executive (FTE) according to an embodiment of the invention.
- the Kernal 52 provides all of the supervisory operations for the RMS.
- the Kernal 52 manages the startup of RMS, calling the appropriate functions to initialize the target processor as well as the loading of all initial data.
- the Kernal configures the CCDL module by loading the system configuration data and the proper operational parameters.
- the Kernal manages the transitions between the RMS operating nodes (i.e., Cold-Start, Warm-Start, and Steady- State) by monitoring the status of other RMS modules and taking the appropriate actions at the correct times.
- the RMS operating nodes i.e., Cold-Start, Warm-Start, and Steady- State
- the Kernal uses a deterministic scheduling algorithm such that all 'actions' are controlled by a self-contained time base. At a given 'tick' in the time-base cycle, the predetermined actions for that tick are always executed.
- the Kernal 52 coordinates FTE functions based on the time tick.
- RMS activities such as fault detection, isolation and recovery, are scheduled by the Kernal at the appropriate times in the RMS minor frame. If a RMS channel becomes faulty, the Kernal has the responsibility for restarting the channel at the proper time. All data transfers between the RMS subsystems and between RMS and the application computer(s) are managed and scheduled by the Kernal.
- the Kernal directs the other modules to prepare various RMS messages and loads those messages into the CCDL for transmission at the Kernal' s request. As messages are received by the CCDL, the Kernal extracts those messages and dispatches them to the correct module(s) for processing. The Kernal runs in a loop, continuously executing each of the scheduled actions and monitoring the RMS status.
- the Fault Tolerant Executive provides Byzantine fault resilience for 4 or more nodes. Byzantine safe is provided for 3 nodes under the condition of source congruency.
- the FTE votes application data, removes/reinstates applications for FTE, and synchronizes application and FTEs to ⁇ 100 sec skew.
- the FTE takes approximately 4.08 msec (40% utilization) to vote 150 words and perform operating system functions.
- the FTE memory is 0.4 Mbytes of Flash (5% utilization) and 0.6 Mbytes of SRAM (5% utilization).
- FIG. 7 shows the RMS context or exchange structure between the RMS and VMC in the operating environment.
- the information being transferred within the VMC includes the RMS System Data which is delivered at the RMS Frame Boundary, and includes information such as the minor frame number, the voted current/next system state for indicating who is operating in and out of the operating set, and a system conflict flag for use in a two node configuration.
- the Data Conflict Table is used in a two node configuration for indicating an unresolvable data conflict on a peer data element basis.
- the Voted Output is the voted value for each data element submitted for voting from an operating set member.
- the RMS System Data, Data Conflict Table and Voted Output are transferred by the RMS to the Global shared memory that is in communication with the local VMC in which the RMS is operating.
- the Raw Output is data submitted to the RMS for voting by all nodes in Steady State mode.
- the Application Error Count is an optional capability of the system, and is transferred to the RMS for enabling an application to affect the error penalty assessed by the RMS in determining the operating set.
- the Frame boundary information includes an interrupt to signal the beginning of a RMS frame. This signal frame synchronizes the FM, VSM, and MM.
- the Mid-Frame information is another interrupt which provides a signal 5 msecs from the beginning of the frame.
- the Application Data Ready information includes an interrupt generated by the RMS to signal the applications that voted data is waiting and can be retrieved and processed.
- the System Reset is an optional control that the application can use on reset.
- the CCDL module provides data communication among channels.
- the data is packaged into messages and the message structure is shown in FIG. 8.
- the message structure includes a header, and various message types according to the types of messages being transmitted and received.
- Message type 0 is the structure of a data message
- type 1 is the structure for a system state message
- type 2 is the structure of a cold start message
- type 3 is the structure of an error report and penalty count message.
- Each CCDL has a transmitter and up to eight receivers.
- the CCDL top level architecture, transmitter and receiver schematics are depicted in FIGS. 9-11.
- FIG. 9 shows a top level CCDL architecture with one transmitter 70, four receivers 72a-72d, and two interfaces 74a and 74b using a DY4 MaxPac mezzanine protocol.
- One interface 74b facilitates data exchange between the base VME card and the CCDL memory, and the other interface 74a handles control logic and error reporting.
- the CCDL interface 74b takes data from the base card and stores it into the 8bit transmitter memory 76.
- the four receivers 72a-d process and store the received data in the four receiver memories 78a-d, respectively, one for each node.
- the FTE then takes the data under the control of the CCDL. Since the CCDL is the only module which establishes physical connection among channels, it must enforce electrical isolation in order to guarantee Fault Containment Region for the system.
- the present CCDL uses the electrical-to-optical conversion to convert electrical signals to optical signals.
- Each receiver 72a-72d has a corresponding optical isolator 73a-73d to provide the necessary isolation function. This enables every channel to have its own power supply, and all of them are electrically isolated from each other.
- FIG. 10 shows a more detailed view of the transmitter 70 architecture in accordance with an embodiment of the present invention.
- the transmitter control logic 80 reads data from its 8 bit memory 76, forms the data into a 32 bit format, and appends a horizontal word to the end of the data.
- the shift register circuit 82 converts the data into a serial bit string with vertical parity bits inserted into the string for transmission.
- FIG. 11 illustrates how the serial data string is received from a transmitting mode and stored in its corresponding memory.
- the Bit Center logic 90 uses 6 system clock (e.g., 48 MHZ) cycles to reliably log in one data bit.
- the Time Stamp logic 92 records the time for synchronization purposes.
- the shifter circuit 94 strips vertical parity bits and converts serial data into 8 bit format. An error will be reported should the vertical bit show transmission errors.
- the control logic 96 further strips horizontal parity from the data and stores it into the receiver memory (e.g., 78a) according to the node number information attached with the data.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Hardware Redundancy (AREA)
- Multi Processors (AREA)
Applications Claiming Priority (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US8773398P | 1998-06-02 | 1998-06-02 | |
US87733P | 1998-06-02 | ||
US09/140,174 US6178522B1 (en) | 1998-06-02 | 1998-08-25 | Method and apparatus for managing redundant computer-based systems for fault tolerant computing |
US140174 | 1998-08-25 | ||
PCT/US1999/012000 WO1999063440A1 (fr) | 1998-06-02 | 1999-06-02 | Procede et appareil de gestion de systemes informatiques redondants pour traitement tolerant aux fautes |
Publications (2)
Publication Number | Publication Date |
---|---|
EP1082661A1 EP1082661A1 (fr) | 2001-03-14 |
EP1082661A4 true EP1082661A4 (fr) | 2005-11-09 |
Family
ID=26777328
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP99930130A Withdrawn EP1082661A4 (fr) | 1998-06-02 | 1999-06-02 | Procede et appareil de gestion de systemes informatiques redondants pour traitement tolerant aux fautes |
Country Status (8)
Country | Link |
---|---|
US (1) | US6178522B1 (fr) |
EP (1) | EP1082661A4 (fr) |
JP (1) | JP2002517819A (fr) |
CN (1) | CN1192309C (fr) |
AU (1) | AU4673499A (fr) |
CA (1) | CA2334009A1 (fr) |
TW (1) | TW486637B (fr) |
WO (1) | WO1999063440A1 (fr) |
Families Citing this family (45)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE19921179C2 (de) * | 1999-05-07 | 2002-04-25 | Astrium Gmbh | Logikeinheit nach byzantinem Algorithmus, Rechnereinheit mit solcher Logikeinheit, Verbund aus Logik- oder Rechnereinheiten und Verfahren zum Betreiben eines solchen Verbunds |
US6671821B1 (en) * | 1999-11-22 | 2003-12-30 | Massachusetts Institute Of Technology | Byzantine fault tolerance |
US8423674B2 (en) * | 2001-06-02 | 2013-04-16 | Ericsson Ab | Method and apparatus for process sync restart |
US6813527B2 (en) | 2002-11-20 | 2004-11-02 | Honeywell International Inc. | High integrity control system architecture using digital computing platforms with rapid recovery |
GB2395639A (en) * | 2002-11-21 | 2004-05-26 | Matsushita Electric Ind Co Ltd | System operable in either architecture reconfiguration mode or processing mode depending on the contents of a frame header |
US7136793B2 (en) * | 2003-01-14 | 2006-11-14 | Lockheed Martin Corporation | System and method for modeling a propagation and containment process |
JP2006529072A (ja) * | 2003-05-20 | 2006-12-28 | コーニンクレッカ フィリップス エレクトロニクス エヌ ヴィ | 二重チャネルネットワークの同期化に関する時間トリガ型通信システムおよび方法 |
US20070128895A1 (en) * | 2003-11-17 | 2007-06-07 | Dieter Kleyer | Redundant automation system for controlling a techinical device, and method for operating such an automation system |
US7350113B2 (en) * | 2004-05-11 | 2008-03-25 | International Business Machines Corporation | Control method, system, and program product employing an embedded mechanism for testing a system's fault-handling capability |
US20060136490A1 (en) * | 2004-12-17 | 2006-06-22 | International Business Machines Corporation | Autonomic creation of shared workflow components in a provisioning management system using multi-level resource pools |
US7499865B2 (en) * | 2004-12-17 | 2009-03-03 | International Business Machines Corporation | Identification of discrepancies in actual and expected inventories in computing environment having multiple provisioning orchestration server pool boundaries |
US7953703B2 (en) * | 2005-02-17 | 2011-05-31 | International Business Machines Corporation | Creation of highly available pseudo-clone standby servers for rapid failover provisioning |
US20070220367A1 (en) * | 2006-02-06 | 2007-09-20 | Honeywell International Inc. | Fault tolerant computing system |
US20070186126A1 (en) * | 2006-02-06 | 2007-08-09 | Honeywell International Inc. | Fault tolerance in a distributed processing network |
US8510596B1 (en) | 2006-02-09 | 2013-08-13 | Virsec Systems, Inc. | System and methods for run time detection and correction of memory corruption |
US20070260939A1 (en) * | 2006-04-21 | 2007-11-08 | Honeywell International Inc. | Error filtering in fault tolerant computing systems |
US8977252B1 (en) * | 2006-07-06 | 2015-03-10 | Gryphonet Ltd. | System and method for automatic detection and recovery of malfunction in mobile devices |
US7685464B2 (en) * | 2006-11-20 | 2010-03-23 | Honeywell International Inc. | Alternating fault tolerant reconfigurable computing architecture |
US7898937B2 (en) * | 2006-12-06 | 2011-03-01 | Cisco Technology, Inc. | Voting to establish a new network master device after a network failover |
CA2673484A1 (fr) * | 2006-12-21 | 2008-06-26 | Biokine Therapeutics Ltd. | Analogues peptidiques de t-140 presentant une activite superagoniste par rapport a cxcr4 destines a une cancerotherapie |
US8036805B2 (en) * | 2007-07-13 | 2011-10-11 | Honeywell International Inc. | Distributed engine control system |
US20090106781A1 (en) * | 2007-10-23 | 2009-04-23 | Reed Benjamin C | Remote call handling methods and systems |
US8255732B2 (en) * | 2008-05-28 | 2012-08-28 | The United States Of America, As Represented By The Administrator Of The National Aeronautics And Space Administration | Self-stabilizing byzantine-fault-tolerant clock synchronization system and method |
US8656392B2 (en) * | 2009-06-10 | 2014-02-18 | The Boeing Company | Consensus based distributed task execution |
JP5560113B2 (ja) * | 2010-06-25 | 2014-07-23 | 株式会社日立製作所 | 計算機システム及び計算機の管理方法 |
CN102193835B (zh) * | 2011-03-25 | 2013-01-30 | 上海磁浮交通发展有限公司 | 基于3取2计算机系统的预执行方法 |
CN103562805B (zh) * | 2011-03-30 | 2017-06-30 | 维斯塔斯风力系统集团公司 | 具有高度可靠实时功率控制的风力发电厂 |
CN102411520B (zh) * | 2011-09-21 | 2013-09-25 | 电子科技大学 | 一种基于数据单元的地震数据的灾难恢复方法 |
CN102622323B (zh) * | 2012-03-27 | 2014-11-19 | 首都师范大学 | 动态可重构串行总线中基于开关矩阵的数据传输管理方法 |
ES2877551T3 (es) | 2013-04-24 | 2021-11-17 | Fresenius Kabi Deutschland Gmbh | Procedimiento de funcionamiento de un dispositivo de control para controlar un dispositivo de infusión |
WO2014192005A1 (fr) * | 2013-05-27 | 2014-12-04 | Hewlett-Packard Development Company, L.P. | Message d'état système dans une mise en réseau définie par un logiciel |
US9448548B2 (en) * | 2013-06-14 | 2016-09-20 | Honeywell International Inc. | Synchronizing and displaying fault tolerant Ethernet (FTE) status |
WO2015033410A1 (fr) * | 2013-09-04 | 2015-03-12 | 株式会社東芝 | Système de traitement d'informations, dispositif serveur, procédé de traitement d'informations et programme |
KR102368170B1 (ko) | 2013-09-12 | 2022-02-25 | 버섹 시스템즈, 인코포레이션 | 멀웨어의 자동화된 런타임 검출 |
WO2015140942A1 (fr) * | 2014-03-18 | 2015-09-24 | 株式会社東芝 | Système de traitement d'informations, dispositif serveur, procédé de traitement d'informations, et programme |
AU2015279923B9 (en) | 2014-06-24 | 2018-01-25 | Virsec Systems, Inc. | System and methods for automated detection of input and output validation and resource management vulnerability |
EP3161638A1 (fr) * | 2014-06-24 | 2017-05-03 | Virsec Systems, Inc. | Analyse de cause première automatisée sur des applications à niveau simple ou à n niveaux |
WO2016020986A1 (fr) * | 2014-08-05 | 2016-02-11 | 株式会社東芝 | Dispositif d'alignement, dispositif de traitement de données, programme, procédé d'alignement, et système de multiplexage |
CN104635745B (zh) * | 2015-03-02 | 2017-03-22 | 中国航空无线电电子研究所 | 一种飞行管理系统双机同步的方法 |
US10025344B2 (en) | 2015-04-21 | 2018-07-17 | The United States Of America As Represented By The Administrator Of Nasa | Self-stabilizing distributed symmetric-fault tolerant synchronization protocol |
AU2017285429B2 (en) | 2016-06-16 | 2022-03-31 | Virsec Systems, Inc. | Systems and methods for remediating memory corruption in a computer application |
CN107145407B (zh) * | 2017-05-16 | 2020-10-27 | 中林云信(上海)网络技术有限公司 | 一种对数据进行本地备份的方法 |
CN112506035A (zh) * | 2020-11-03 | 2021-03-16 | 中国航空工业集团公司西安航空计算技术研究所 | 一种作动器控制计算机的同步系统 |
CN113900979B (zh) * | 2021-09-08 | 2024-03-19 | 中国航空工业集团公司西安航空计算技术研究所 | 一种双功能区共单ccdl传输体系 |
CN114280919B (zh) * | 2022-03-08 | 2022-05-31 | 浙江中控技术股份有限公司 | 冗余控制装置 |
Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4933940A (en) * | 1987-04-15 | 1990-06-12 | Allied-Signal Inc. | Operations controller for a fault tolerant multiple node processing system |
Family Cites Families (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4228496A (en) | 1976-09-07 | 1980-10-14 | Tandem Computers Incorporated | Multiprocessor system |
US4503535A (en) | 1982-06-30 | 1985-03-05 | Intel Corporation | Apparatus for recovery from failures in a multiprocessing system |
JPS5985153A (ja) | 1982-11-08 | 1984-05-17 | Hitachi Ltd | 冗長化制御装置 |
US4634110A (en) | 1983-07-28 | 1987-01-06 | Harris Corporation | Fault detection and redundancy management system |
US4575842A (en) | 1984-05-14 | 1986-03-11 | The United States Of America As Represented By The Secretary Of The Air Force | Survivable local area network |
US4847837A (en) | 1986-11-07 | 1989-07-11 | The United States Of America As Represented By The Administrator Of The National Aeronautics And Space Administration | Local area network with fault-checking, priorities and redundant backup |
US4933838A (en) | 1987-06-03 | 1990-06-12 | The Boeing Company | Segmentable parallel bus for multiprocessor computer systems |
US4907232A (en) | 1988-04-28 | 1990-03-06 | The Charles Stark Draper Laboratory, Inc. | Fault-tolerant parallel processing system |
US5068499A (en) | 1989-04-14 | 1991-11-26 | Alps Electric Co., Ltd. | Control lever type input device |
US5261085A (en) | 1989-06-23 | 1993-11-09 | Digital Equipment Corporation | Fault-tolerant system and method for implementing a distributed state machine |
US5173689A (en) | 1990-06-25 | 1992-12-22 | Nec Corporation | Self-distributed logical channel node failure restoring system |
US5325518A (en) | 1991-04-02 | 1994-06-28 | Carnegie Mellon University | Adaptive distributed system and method for fault tolerance |
US5684807A (en) | 1991-04-02 | 1997-11-04 | Carnegie Mellon University | Adaptive distributed system and method for fault tolerance |
US5280607A (en) | 1991-06-28 | 1994-01-18 | International Business Machines Corporation | Method and apparatus for tolerating faults in mesh architectures |
US5349654A (en) | 1992-02-20 | 1994-09-20 | The Boeing Company | Fault tolerant data exchange unit |
US5271014A (en) | 1992-05-04 | 1993-12-14 | International Business Machines Corporation | Method and apparatus for a fault-tolerant mesh with spare nodes |
US5533188A (en) * | 1992-10-19 | 1996-07-02 | The United States Of America As Represented By The Administrator Of The National Aeronautics And Space Administration | Fault-tolerant processing system |
US5513313A (en) | 1993-01-19 | 1996-04-30 | International Business Machines Corporation | Method for generating hierarchical fault-tolerant mesh architectures |
US5473771A (en) | 1993-09-01 | 1995-12-05 | At&T Corp. | Fault-tolerant processing system architecture |
US5450578A (en) | 1993-12-23 | 1995-09-12 | Unisys Corporation | Method and apparatus for automatically routing around faults within an interconnect system |
US5561759A (en) | 1993-12-27 | 1996-10-01 | Sybase, Inc. | Fault tolerant computer parallel data processing ring architecture and work rebalancing method under node failure conditions |
FR2721122B1 (fr) | 1994-06-14 | 1996-07-12 | Commissariat Energie Atomique | Unité de calcul à pluralité de calculateurs redondants. |
US5463615A (en) | 1994-07-07 | 1995-10-31 | At&T Corp. | Node failure restoration tool |
JP3447404B2 (ja) | 1994-12-08 | 2003-09-16 | 日本電気株式会社 | マルチプロセッサシステム |
US5736933A (en) | 1996-03-04 | 1998-04-07 | Motorola, Inc. | Method and apparatus for providing redundancy in a communication network |
US5790397A (en) | 1996-09-17 | 1998-08-04 | Marathon Technologies Corporation | Fault resilient/fault tolerant computing |
-
1998
- 1998-08-25 US US09/140,174 patent/US6178522B1/en not_active Expired - Lifetime
-
1999
- 1999-06-02 WO PCT/US1999/012000 patent/WO1999063440A1/fr active Application Filing
- 1999-06-02 EP EP99930130A patent/EP1082661A4/fr not_active Withdrawn
- 1999-06-02 JP JP2000552586A patent/JP2002517819A/ja not_active Withdrawn
- 1999-06-02 CN CNB998092908A patent/CN1192309C/zh not_active Expired - Fee Related
- 1999-06-02 AU AU46734/99A patent/AU4673499A/en not_active Abandoned
- 1999-06-02 CA CA002334009A patent/CA2334009A1/fr not_active Abandoned
- 1999-10-01 TW TW088109143A patent/TW486637B/zh not_active IP Right Cessation
Patent Citations (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4933940A (en) * | 1987-04-15 | 1990-06-12 | Allied-Signal Inc. | Operations controller for a fault tolerant multiple node processing system |
Non-Patent Citations (2)
Title |
---|
KIECKHAFER R M ET AL: "THE MAFT ARCHITECTURE FOR DISTRIBUTED FAULT TOLERANCE", IEEE TRANSACTIONS ON COMPUTERS, IEEE INC. NEW YORK, US, vol. 37, no. 4, April 1988 (1988-04-01), pages 398 - 405, XP000648384, ISSN: 0018-9340 * |
See also references of WO9963440A1 * |
Also Published As
Publication number | Publication date |
---|---|
US6178522B1 (en) | 2001-01-23 |
JP2002517819A (ja) | 2002-06-18 |
TW486637B (en) | 2002-05-11 |
CA2334009A1 (fr) | 1999-12-09 |
CN1311877A (zh) | 2001-09-05 |
CN1192309C (zh) | 2005-03-09 |
AU4673499A (en) | 1999-12-20 |
EP1082661A1 (fr) | 2001-03-14 |
WO1999063440A1 (fr) | 1999-12-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US6178522B1 (en) | Method and apparatus for managing redundant computer-based systems for fault tolerant computing | |
EP0481231B1 (fr) | Procédé et système d'augmentation de la disponibilité opérationnelle d'un système de programmes d'ordinateur opérant dans un système distribué d'ordinateurs | |
US4907232A (en) | Fault-tolerant parallel processing system | |
Keichafer et al. | The MAFT architecture for distributed fault tolerance | |
US4914657A (en) | Operations controller for a fault tolerant multiple node processing system | |
US6012150A (en) | Apparatus for synchronizing operator initiated commands with a failover process in a distributed processing system | |
US5210871A (en) | Interprocessor communication for a fault-tolerant, mixed redundancy distributed information processing system | |
EP2226700B1 (fr) | Taktbereitstellungsverfahren und Informationsverarbeitungsvorrichtung | |
Katsuki et al. | Pluribus—An operational fault-tolerant multiprocessor | |
US5404363A (en) | Two-fail-operational fault-tolerant multiple clock system | |
US20020120884A1 (en) | Multi-computer fault detection system | |
CN113127270A (zh) | 一种基于云计算的3取2安全计算机平台 | |
US5533188A (en) | Fault-tolerant processing system | |
LALA | Advanced information processing system | |
US20100229028A1 (en) | Information processing apparatus, information processing system, and control method therefor | |
Pimentel et al. | A fault management protocol for TTP/C | |
Thompson | Transputer-based fault tolerance in safety-critical systems | |
US20030158972A1 (en) | Device and method for the synchronization of a system of networked computers | |
CN100559322C (zh) | 具对称式多处理器性能的刀锋式丛集系统之时序分配结构 | |
KR20050097015A (ko) | 대형시스템에서 고장 감내 기능 구현을 위한 이중화 방법 | |
Bolduc | Clock synchronization in an N-modular redundant system | |
Burkhardt et al. | Advanced information processing system: Local system services | |
Wirthumer et al. | Fault Tolerance for Railway Signalling Votrics in Practice | |
KR20030064072A (ko) | Atm 교환 시스템에서 이중 미디어 게이트웨이 장치 및제어 방법 | |
CN118012823A (zh) | 一种在单片soc芯片上实现同步多余度计算的方法 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20001207 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AT DE FR GB PT |
|
A4 | Supplementary search report drawn up and despatched |
Effective date: 20050927 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20100105 |